Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
16/05/2024, 09:10
Static task
static1
Behavioral task
behavioral1
Sample
4a5b40afd567b3e4860d022be139cb64_JaffaCakes118.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4a5b40afd567b3e4860d022be139cb64_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
4a5b40afd567b3e4860d022be139cb64_JaffaCakes118.html
-
Size
37KB
-
MD5
4a5b40afd567b3e4860d022be139cb64
-
SHA1
69409ebe1fa46d728355d392a2fa85ccc1d5b8ce
-
SHA256
d496ee01791ba8e0742c6ee747b5d6b58eb368dceaa81bf0b666e57fce2671ac
-
SHA512
e9af5f3ef4555532dcb13d625dd88840bf6b3fcaf2be35f191e0b935de52e9a47d54c34c3c0183a6870400345016d81d802204a24c982124cb32e0d517c6854b
-
SSDEEP
768:SyKzC6CYCdC+CuCT227jKSK5e9slhgiI6c:SRnNq9Bc2De9Ghgi9c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422012522" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000064b896168fbd63cd845fd3a9923f1260f2d85273fc8ce5df1c00a82538522c11000000000e8000000002000020000000e6e5490a91e61e249e5f90b182905d960794893e2a63b60f43315b50779a4a3d90000000cb58f92829f0b4dcbbb743a2c2c4554d27c979173dabdb0cb6f77a9315c888256a7299f1c8f369d2af1f47f71afd23c7c4356a6be78a5e68471e250b0a8fcea5daeb185a7ae4fa21d183e27c107a283b9e242bd9d8a0f88108df69c0b3d54214341f5fdbc3bd6ad4fd85c444412a56086a6486217cbd713b8e2d5563b17ac07b2e9add4978dc403d036d89ed3c36d3d240000000439c094384123f7369bca11b4ae09352aa6c2522c1ee74079bcf4d289243f1db52ffb3956b3208ae1ffc9f543ff082c22d2c8de2f3f3ba72c6d66496c42970bf iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a3ca1771a7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{337C05B1-1364-11EF-84C7-4637C9E50E53} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b0000000002000000000010660000000100002000000064a08f8702ec8003ddd264e589ebc5e70f919b0eef22ecb488bfa292f61a693a000000000e800000000200002000000036a66b38706e2b917dc108300913378bb0f74eec8bbe6a6b78544dd2e93ba006200000009d5276ddd1fc7999458fb227e9dbbf0217c326c54f897d7d8f780930c15135fa4000000064f79c6e43f708dd9fcf2388751b7a7fd0108490006a89a89026bf5a1ecfe8ac4f5f15174ca1793e2e1e374aa859f351272c74f8a5326197b902b354377d0afa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1916 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1916 iexplore.exe 1916 iexplore.exe 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE 1636 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1636 1916 iexplore.exe 28 PID 1916 wrote to memory of 1636 1916 iexplore.exe 28 PID 1916 wrote to memory of 1636 1916 iexplore.exe 28 PID 1916 wrote to memory of 1636 1916 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a5b40afd567b3e4860d022be139cb64_JaffaCakes118.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1636
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54399d942680b15cc4b0c87725d3e114c
SHA181f0c9699d4eecb38c8a5dd018052d0b38f304db
SHA256de3055e6db9f82c4349b7f79c44de7eb5ea8a50f12dcb02f80e50e7d45a98efa
SHA5129b56ab06a3be057cd73707b2c37f7d32b76aaab76fdeab0b57b2886eb347294b66a54b3988fabeaf69954223afff68d18962f6737a4db93bab57ccaac2d0fb2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d89831a1f9fcce056e241cf0d52a47e
SHA189966be4a557eb96725ccb361d84738e741c9229
SHA256f0b78e726c0ee3941e38c1a9a52d57ad8ddd9243f0a5ef37add15d88ec934569
SHA512c715440c406cd09d04ab9b12b6326745d7dfe959e56a13d2274f0d946afb957bfc8310cc467167100436b79aa61931188a9828b0d6f47a13d375b8cfacb41c4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5159797dcc6647e69f0db1dfe87d07b35
SHA1aaee1d56e7f02f7b561e8e1a391c0c539bde24d4
SHA256d7140df32a8805f2f2758e7ab8d7c110348d6eddca4ec4aad76b6383ce248707
SHA5122af3e36e7dfd186b20bdc7189824a10ebfd1f887c69a5031e74839fca347121c14e51aa0e907ba19a1100fc3670f46810dcef23672eef00a3bb3ca330f78fdf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec9fbe2dd1118d85f1a76473698ab9da
SHA1d2702270d91ff3ade62133ac761301f240b662ec
SHA256b871e3515aa49bb451f67efc09a33edb66b4144c85e32034e180cdb34aaea064
SHA51203a18915079d9a205e8f1ab10422bc14df6dca7c6379d8f3a2f181c607e6d408d0f0768e47d9ee4a2cc887802c85c4caef4000078343312ac8e282340508f469
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584db7af7f124b42adf40c4d18e24976a
SHA12fd3dcd4ff2a55d38c2617a1012bd42b1ecebb91
SHA256c941c735727b051662bdb21626bb8e6664152dba44aec50377def9151dd0d080
SHA512086e69fa47dde39188735e9e14d494ee896d7412be9b0629e633291c733c006217751b5599fd77951fc310b5b30bec1bdc3e99b7d009be51bab7d5e5047e6d17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e3053ce24955a957ad66e2fb976dab5
SHA1d38cf57a6130a6fa4597b4205134a8ca1118ebf0
SHA256600a0806f809e8fefb2b6e917d3e9377380d2536ca6f4c77e780f2396ca97bad
SHA512ea494165de34dfcfe0761bb6e4cee43dcf5cdcd569db4de89aea05423e8e86c439051a5a8da7dabc696ad00adb90ca92ddfba23d1bd4e52440c782721a6544b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5891f59f5ace3274d130c322bb7e35d9d
SHA1c0d9bbad5269d5cbdb3040fdd0026c9b59170b40
SHA25678a0d3d92716af0b56c36c32399390b5c9e0b7b78de6feb39c1b1ae962435762
SHA512bfdcaf9892526895abce079b4cb3713b2c16e8ec6d9cdcca5ffb00f5fc0418545ac54c1e5617c96d8ec7c75107da7b649acd41411c1e01637eccd70f02899361
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542c5322469b6c0eb3d693bf218391c23
SHA17585e6cfec0538c00b988aa2507f5956a5816e82
SHA2568fa9ac603375cd807742ce570f396ac17d7d26cb442f384564fef0f6435e04dc
SHA5126a6b8f781e0120a219e910217d9326b9791b7d62f7bb25a8645ebf42c1fb321b7eebbe5cc6496881d5c32cf590522e092d08946833e33e6bb1559cdde63e1c21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5778334af55a2e0796209b27e0260eb5d
SHA1c9fb8d22680ac5f6b037114864457a9ef3c27489
SHA2569999c3d41e417a3d26a8b5cfbe61c6f1b9cbcb82a98a0525995dedc2d9a4cae4
SHA512def3cd257ea8fb0ba9a622d30a2b5cb3451c857b612cda65e5da5dd00561be28345944e73d5b0d17b8d23f3cbf23a15b54b0ca4ee0cb46f8a2d17654907ed253
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ac9cbf1ce212bace9d373e0ed8421eb
SHA1713d957f9b05beee1a4ad245f0922611c127cb02
SHA256a4ef3b09f7b5cde0f90e3da3036bcbcc3ca8ad491944c5bc7231a072798a606b
SHA51237688a58508d4ad226b170bd19818579578b14354d268594da44beb480fa4b4f892ee0c9584f646698345919f4482504d596aa2615a24514e528db6e72aa891f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd2e4645f2770b2b85d080481ea4a9e7
SHA199a97875527afe3a29efd27ce395607af4e2b736
SHA256aa563df984411469855019ec34f4995114952b3604727eae8e1cf40fb2c3de70
SHA512e352d8c4888bdd5fc35a562ba03c25d42b523588f89820cf4b37722ba35bde5d7dbe157513593eb7d1d9a9077f972251e0759adc624090091239fd4ba0b0efbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abbc9b1363d47e4acf8f830bd1c19d4f
SHA1bf463bc623ccef4614b7fe4b41a83d8d3f769f4f
SHA2565023e6395258e860d73e88c28969eb42a38d47c94767c9b0460669e2660311a1
SHA512115669fd09d0273924c6c92820d3c78f63478537ebe737c7ba9508bc7adf6dc0fbc2ac1301be32d83b4d3d307f71d648189ec441b2e89dd62b6ab819b4de724f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5064e2ceb5392302cde36b840af49ae6a
SHA17261140b19d16ffef58e9817af1b0a7ab7dd6c6a
SHA256695414cdbd2cd4a3a18405ad9a39b8930db5343254c1a565bbbfeb14acaff68a
SHA512113e1d31e16cc520614289b1f8473e3656c19100dcdc3e3de9ec5e7e4e2115c4912447f8b1240ddb740673a27dad7bb2a38b6f0f334c04a9de33adb32d2a2254
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a25efaa143dd063fc85977bc5c1feefb
SHA18d579bb8526fcdb7e9452ad8bd4af90c782f1130
SHA256c7ce49468ce3aa5a7af8610ccf949f7ac9d3ae81e9c02a04c02de9223443683b
SHA512a4f5b307e85e20628fe3cdf3ce7b952016221cf6119da47cfe8ba023e1d29a74300890bab67e0717fbb63c4dce2da94a73f3819934d0a464bda5ce91a24ce8ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a4ffd0d3cecc81cc35f49121c0bdad7
SHA11dc151ee115f90ea41fcd6a9657d76dc9dcb79f1
SHA256b97849c661d221a83833747a5144707f81b84428d080a7de60e76e9b76960930
SHA512558614f4c0eb794c63e56688fcc5f96f020d504878293dbfe55888257a398cf25e462c163c5eb705247512ab6455a6c0507ea7a19360d3681ea0176d316f4302
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f6f76f0aec786af9c9082a82f0c58e7
SHA1a871bb5399c36d5abd1c4597d6755c770cf9af86
SHA2560723a1053cf1b4d9f52771144fd0a741f11f74d013ff606e64c29c9c99e9fd4c
SHA512e04aa57067f73a00c674dc986c95c5a814cb914f27584943671214c4eb4f2dc6b07f2767e684ffcdfc11a2276eaf5c621836b79224988a72d5f3bcc7aa7615f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe30b48a6c222742eb1e653da7534014
SHA136ff6187a7972aeaaa73a73467d41e0e0ea47a11
SHA256c8678e8c9b4ac67dc2f660aeb768ee7b458030d2e285364cdf88ea8c4e39d62a
SHA512d57ad7967adceb0c655ac553513c49d2a275c82f5ebbd24228266b341d0246f4a597532f8adf7396647784dc14a52ed33b697fe4edf19b713d0d39f86d7c94ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a203a47f9a1271b357de6840818077f
SHA1cabb11b5705d044b38b92fa8fc483f062cb1e8e6
SHA2561dde554d5f4c09dfbc18e69e9fcb523eee3f8d43adee5b9a6febc17880d60520
SHA5122fe2b732efebb715a7db29db963d673892c9847e6402280fc3005476fb009ac1a10955b783e9cfdf5c1010ca21b216fbcece507e78f5c953b5b97e8ca92672c5
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a